Marriott hacking exposes 500m guests’ data

The Marriott International hotel chain said on Friday that the database of its Starwood reservation system had been hacked and that the personal details of up to 500 million guests going as far back as 2014 had been compromised.

The hotel group, which runs more than 6,700 properties around the world, was informed in September about an attempt to access the database, and an investigation this month revealed that unauthorised access had been made on or before September 10, Marriott said in a statement.

The hotel chain said that personal details including names, addresses, dates of birth, passport numbers, email addresses and phone numbers for hundreds of millions of guests may have been compromised.

The investigation also found that an “unauthorised party had copied and encrypted information, and took steps toward removing it,” the statement said.

Hackers also obtained encrypted credit-card information for some customers, but it was unclear if the hackers would be able to use those payment details.

Marriott said it wasn’t sure how many passport numbers and dates of birth were stolen but said that it was a “subset” of the larger number of affected consumers, since this information is not a part of every reservation.

Richard Gold, head of security engineering at the cybersecurity firm Digital Shadows, said the breach ranks among the largest of consumer data, on par with breaches at Yahoo and the credit-scoring giant, Equifax.

“This is an incredibly big number,” Gold said.

He said hotels are an attractive target for hackers because they hold a lot of sensitive information, including credit card and passport details, but often don’t have security standards as tough as those of more regulated industries, like banking.

“We deeply regret this incident,” Arne Sorenson, Marriott’s president and chief executive officer, said in a statement. “We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”

The New York state attorney general, Barbara D. Underwood, said that her office would investigate the Marriott breach.

The breach is far larger than the one last year at Equifax, a credit bureau, from which attackers stole information on 148 million people, including names, Social Security numbers, birth dates and addresses. In that case, the thieves also grabbed scans of around 3,200 passports from people who had uploaded them to an Equifax customer service website.

Equifax has spent more than $400 million on recovery from its breach, according to the company’s regulatory filings.

Marriott said it had set up a dedicated website and call centre to deal with questions guests might have about their personal information, and had notified regulatory and legal authorities. Marriott also said it would try to reach affected customers on Friday to inform them of the security breach.